Organisations see generative AI as a potential source of productivity, but their decision makers are equally conscious of the risks surrounding data privacy and security. A study conducted in early 2024 by Coleman Parkes Research and sponsored by SAS surveyed 300 US leaders responsible for generative AI strategy or data analytics. It found that ambition was running ahead of the structures needed to deploy the technology reliably.
The concerns were not confined to one technical issue. Respondents described challenges in governance, integration, talent and cost forecasting. Those obstacles are connected: a model linked to existing systems can expose more sensitive information; scarce expertise makes controls harder to design; uncertain usage complicates budgets; and weak governance leaves teams without consistent rules. Treating each problem as an isolated checklist item risks missing the broader operating model that generative AI requires.
Governance Has Not Caught Up With Adoption
Only one in ten organisations in the study had a reliable system for measuring bias and privacy risk in large language models. The survey also reported that 93% of US businesses lacked a comprehensive generative AI governance framework. These findings suggest that many companies are experimenting with systems before establishing how models, data and use cases will be approved and monitored.
A governance framework should connect principles with specific decisions. It can define which information may enter an external service, what evidence is required before a model reaches production and who is responsible when output causes harm. It should also account for changing regulation and document why a model is used. Without those mechanisms, policies can remain abstract while employees adopt tools through informal channels.
Integration Expands Both Value and Exposure
Generative AI becomes more useful when it can access business knowledge and participate in existing processes. The same integration creates risk. Compatibility problems can lead to unreliable workflows, while broad data access can expose confidential records. A model connected to email, customer systems or document repositories requires carefully limited permissions and clear boundaries between retrieval, recommendation and action.
SAS strategic AI adviser Marinela Profi argued that large language models should contribute to automation and accelerate existing systems rather than be treated as a universal answer. That framing encourages teams to begin with a process and a human need. It also makes control design more concrete: an organisation can identify the data involved, evaluate where the model may fail and decide when a person must review the result.
Skills and Costs Complicate Production Plans
Respondents worried that internal teams lacked the expertise needed to realise value from generative AI. Hiring shortages affect more than model development. Organisations need people who can assess vendors, prepare private knowledge, design evaluations, integrate systems and operate models after launch. Business specialists must also be involved, because technical teams alone cannot determine whether an answer is appropriate in a regulated or customer-facing context.
Costs add another layer of uncertainty. Token prices are visible, but they represent only part of the total. Preparing knowledge, managing models, running evaluations and maintaining integrations consume time and infrastructure. Usage can also grow rapidly when a pilot becomes a company-wide service. A sustainable plan therefore needs estimates for the complete lifecycle, including oversight and change, rather than multiplying a provider’s token rate by expected requests.
A Use-Case Strategy Can Turn Concern Into Control
The study’s results do not argue against generative AI. They show why enthusiasm needs a progressive strategy. Organisations can start with use cases that solve identifiable human needs, have measurable value and expose manageable data. A bounded internal assistant may be easier to govern than an autonomous customer process. Early projects can develop shared evaluation methods and incident procedures before the technology expands.
Trust also requires ongoing evidence. Bias, privacy and security risk cannot be measured once and forgotten. Data changes, model providers update systems and employees discover new ways to use tools. Monitoring should track quality, access, unusual behaviour and user feedback. When the organisation cannot explain how a system behaves or who owns it, expansion should pause until the gap is resolved.
The survey captures a market moving from experimentation toward accountability. Leaders are discovering that access to a capable model does not produce a complete enterprise system. Integration, governance, skills and economics determine whether the technology creates lasting value. Privacy and security concerns are therefore not obstacles at the edge of adoption; they are central design requirements.
Companies that address them early may move faster in the long run. Clear rules reduce repeated debate, controlled integrations make incidents less likely and realistic budgets prevent pilots from collapsing during scale-up. Generative AI can improve productivity, but only when organisations understand the information it touches and the decisions it influences. The strongest strategy is one that makes those dependencies visible before capability turns into uncontrolled exposure.
Leaders can also use the four problem areas as a readiness test. Before funding a deployment, they can ask whether the organisation has an accountable owner, a safe integration path, the necessary skills and a credible full-cost estimate. A weak answer does not always mean cancelling the use case, but it should narrow the pilot and determine which safeguards must be built first.
This approach turns risk management into a practical sequence rather than a reason for paralysis. Small, well-governed deployments generate evidence that can inform larger decisions. They also reveal whether the promised productivity improvement survives the work of verification, training and oversight. That is the standard enterprise AI must meet to progress from enthusiasm to dependable value.